Fortinet CVE-2026-39815

Requires authenticated access to Fortinet FortiDDoS-F 7.2.1 or 7.2.2 web interface. Attacker must have valid login credentials with sufficient privileges to interact with SQL-injectable parameters. Remote network access required; no victim interaction needed.

This represents a high-severity risk requiring priority remediation. The CVSS 3.1 score of 8.8 reflects network-based exploitation (AV:N) with low complexity (AC:L) requiring only low-privileged authentication (PR:L) and no user interaction (UI:N), achieving high impact across all CIA triad elements (C:H/I:H/A:H). The unchanged scope (S:U) limits impact to the vulnerable component but does not diminish severity given the device's security-critical role. While authentication is required (PR:L), this is a relatively low barrier on enterprise appliances where multiple administrators or service accounts may exist. The low attack complexity suggests reliable exploitation once credentials are obtained. No EPSS score is available yet for this recently disclosed vulnerability, and it is not listed in CISA KEV, indicating no confirmed active exploitation at this time. However, Fortinet products are frequently targeted by sophisticated threat actors, and SQL injection vulnerabilities are well-understood and readily exploitable. The combination of network accessibility, low complexity, and code execution potential makes this a realistic threat despite the authentication requirement. Organizations should prioritize patching based on exposure of management interfaces and credential hygiene practices.

An attacker with compromised low-privileged credentials to the FortiDDoS-F management interface crafts malicious SQL statements within input parameters of vulnerable web application functions. The unsanitized input is incorporated into backend SQL queries, allowing the attacker to extract sensitive database contents including configuration secrets and traffic analysis data, modify DDoS protection policies to disable defenses, or execute operating system commands through database-stored procedures or functions, potentially achieving full appliance compromise.